MALICIOUS — normal_5f89ed8542502.pdf
MALICIOUS — normal_5f89ed8542502.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
839b395b64ddd36871ee6563aa08b6af88dfb69586093959ed7b1007364e539e - SHA-1:
c162194a088021bfa39c3eedbd8098f50c5de05e - MD5:
7078596eeba23c979c66174a4e24d9fa - ssdeep:
768:1JgGzpDPprL4BaZhf2zNSt1mkIfDWH67v9WX0LHYEQSMLZGOWBBUF+vVl8kyUJ04:sGFrp/LgVRLHvDMJcaA38eSho7V - TLSH:
T12F328EF35097EC8C7A8E5B13ADAB129E6489D78CA137A750448C772CC4BC5FD6B00A25 - Submitted as: normal_5f89ed8542502.pdf
- File type: pdf · Size: 44728 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://vewutaniwem.weebly.com/uploads/1/3/0/8/130873717/6eeed2758a.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ttraff.club/123?keyword=farming+simulator+19+full+apk+download, https://cdn-cms.f-static.net/uploads/4368486/normal_5f88ff7383a7b.pdf, https://cdn-cms.f-static.net/uploads/4368223/normal_5f88304ec3d47.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.club/123?keyword=farming+simulator+19+full+apk+download
- https://cdn-cms.f-static.net/uploads/4368486/normal_5f88ff7383a7b.pdf
- https://cdn-cms.f-static.net/uploads/4368223/normal_5f88304ec3d47.pdf
- https://cdn-cms.f-static.net/uploads/4368250/normal_5f89af9b688e4.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f876d45bb6a8.pdf
- https://cdn.shopify.com/s/files/1/0268/7093/9843/files/fawadulego.pdf
- https://cdn.shopify.com/s/files/1/0499/8434/0118/files/kefodikafupa.pdf
- https://vewutaniwem.weebly.com/uploads/1/3/0/8/130873717/6eeed2758a.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/caa64.pdf
- https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/57d02b5e848c77.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/tadib-pepalitegugoj.pdf
- https://putojedenavaxo.weebly.com/uploads/1/3/2/6/132683165/fiwonojeju.pdf
- https://cdn-cms.f-static.net/uploads/4367625/normal_5f878d81850fa.pdf
- https://cdn-cms.f-static.net/uploads/4365624/normal_5f8854142384e.pdf
- https://cdn-cms.f-static.net/uploads/4366958/normal_5f87c02ce6902.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f88d601566c6.pdf
- https://wepeweguwerixum.weebly.com/uploads/1/3/1/8/131856135/4028075.pdf
- https://jumuwubugunitus.weebly.com/uploads/1/3/1/0/131070493/329260.pdf
- https://fusesekomufe.weebly.com/uploads/1/3/1/6/131606177/422337.pdf
- https://mamexobupelo.weebly.com/uploads/1/3/1/3/131383482/rorosikezoseri.pdf
- https://cdn.shopify.com/s/files/1/0436/5330/0377/files/80102326435.pdf
- https://cdn.shopify.com/s/files/1/0483/4616/9504/files/bencotto_san_diego_yelp.pdf
- https://cdn.shopify.com/s/files/1/0428/4959/9644/files/13071173458.pdf
- https://cdn.shopify.com/s/files/1/0266/8757/0105/files/gedobarobabudepokare.pdf
- https://cdn.shopify.com/s/files/1/0479/1979/2294/files/58278479890.pdf
Embedded domains
- ttraff.club
- cdn-cms.f-static.net
- cdn.shopify.com
- vewutaniwem.weebly.com
- dimaxafazeza.weebly.com
- jufaxexave.weebly.com
- genigudepa.weebly.com
- putojedenavaxo.weebly.com
- wepeweguwerixum.weebly.com
- jumuwubugunitus.weebly.com
- fusesekomufe.weebly.com
- mamexobupelo.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report